本页面介绍如何解决 Backup and DR Service 针对以下资源（使用备份方案在备份保险柜中备份）出现的问题。如需查找使用管理控制台中的备份模板保护的资源的解决方案，请参阅事件 ID 和错误消息。
PERMISSION_DENIED 个问题
由于源项目中缺少权限，备份作业失败，并显示以下错误消息：
Backup and DR agent or backup vault service agent is missing the permissions required to take backups of resources in the source project.
如需解决此问题，请执行以下操作：
如果备份保险库和资源位于同一项目中，请将 Backup and DR 代理 (roles/backupdr.serviceAgent) IAM 角色分配给 service-<project-number>@gcp-sa-backupdr.iam.gserviceaccount.com 格式的备份 dr 服务代理。
如果备份保险柜和要保护的资源位于不同的项目中，请将 Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1) IAM 角色分配给 Backup and DR 服务代理，该代理的格式为 service-<project-number>@gcp-sa-backupdr.iam.gserviceaccount.com。
FAILED_PRECONDITION 个问题
删除受保护的资源时，备份作业失败，并显示以下错误消息：
Backup job failed due to unmet conditions. Check for source resource deletion or backup misconfigurations.
如果尝试备份 Persistent Disk 或 Google Cloud Hyperdisk 时，由于在创建备份期间违反了组织政策限制条件而失败，则会发生错误 412，并显示一条错误消息，指出Error 412: Constraint constraints/compute.storageResourceUseRestrictions violated for project aaaaa. projects/aaax/zones/aa-aaaaa-a/disks/aaaa can't be used within your project., conditionNotMet
Backup and DR 会创建永久性磁盘和 Google Cloud Hyperdisk 的备份。备份位于由 Google Cloud管理的 Google Cloud 项目（也称为租户项目）中。租户项目位于 google.com 组织内，与您自己的组织分开。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Troubleshoot backup failure issues\n\nThis page shows you how to resolve issues with Backup and DR Service for\nresources that are backed up within the backup vault using the\n[backup plan](/backup-disaster-recovery/docs/cloud-console/backup-plan). To find\nsolutions for resources protected using the\n[backup template](/backup-disaster-recovery/docs/create-plan/create-template)\nin the management console, see [Event IDs and error messages](/backup-disaster-recovery/docs/event-codes).\n\n`PERMISSION_DENIED` issue\n-------------------------\n\nThe backup job failed due to missing permissions in the source project and\nthe following error message is displayed: \n\n Backup and DR agent or backup vault service agent is missing the permissions required to take backups of resources in the source project.\n\nTo resolve the issue, do the following:\n\n1. If the backup vault and the resource are in the same project, assign the Backup and DR agent (`roles/backupdr.serviceAgent`) IAM role to the [backup dr service agent](/backup-disaster-recovery/docs/cloud-console/backup-vault-create#agent), which is in the `service-\u003cproject-number\u003e@gcp-sa-backupdr.iam.gserviceaccount.com` format.\n2. If the backup vault and the resource to protect are in different projects, assign the Compute instance admin (v1) (`roles/compute.instanceAdmin.v1`) IAM role to the [backup dr service agent](/backup-disaster-recovery/docs/cloud-console/backup-vault-create#agent), which is in the `service-\u003cproject-number\u003e@gcp-sa-backupdr.iam.gserviceaccount.com` format.\n\n`FAILED_PRECONDITION` issue\n---------------------------\n\nThe backup job failed when the protected resource was deleted and the following\nerror message is displayed: \n\n Backup job failed due to unmet conditions. Check for source resource deletion or backup misconfigurations.\n\nTo resolve this issue, do the following:\n\n- Verify that the protected resource still exists from the **VM instances** page.\n\n [Go to VM instances](https://console.cloud.google.com/compute/instances)\n- If the deletion was intentional, [unprotect the Compute Engine instance](/backup-disaster-recovery/docs/cloud-console/compute/compute-instance-backup#unprotect).\n\nError 412: constraints/compute.storageResourceUseRestrictions violated\n----------------------------------------------------------------------\n\nError 412 occurs when an attempt to back up a Persistent Disk or Google Cloud Hyperdisk\nfails due to an organization policy constraint violation during backup creation,\nresulting in an error message stating\n`Error 412: Constraint constraints/compute.storageResourceUseRestrictions violated for project aaaaa. projects/aaax/zones/aa-aaaaa-a/disks/aaaa can't be used within your project., conditionNotMet`\n\nBackup and DR creates backups of your Persistent Disks and Google Cloud Hyperdisks.\nThe backups reside in your Google Cloud project (also known as the tenant project)\nthat is managed by Google Cloud. The tenant project exists within the\ngoogle.com organization, separate from your own organization.\n\nYour organization policy dictates where you can create storage resources.\n`The Constraint constraints/compute.storageResourceUseRestrictions violated`\nerror means that a resource or backup is violating the policy by being created\nin a tenant project that isn't part of your allowed organizational structure.\nBecause the tenant project is within the google,com organization, it falls outside of\nyour defined policy, which leads to the backup failure.\n\nTo resolve this error, use the following instructions:\n\n1. Locate the organization policy that implements the\n `constraints/compute.storageResourceUseRestrictions` constraint. For more\n information about how to view organization policies using the Google Cloud console,\n see [Viewing organization policies](/resource-manager/docs/organization-policy/creating-managing-policies#viewing_organization_policies).\n\n2. Modify the `constraints/compute.storageResourceUseRestrictions` policy to\n include the `folders/238813353932` tenant project folder used by\n Backup for GKE in its allowlist.\n\n | **Note:** Make sure the specified folder ID is added to the list of allowed locations to permit Backup for GKE to create snapshots within its tenant projects, even though they are outside your organizational hierarchy.\n3. Save the policy changes after you add the folder to the allowlist.\n\n4. Retest the backup operation after the organization policy updates and\n propagates, which usually takes a few minutes. The backup should proceed\n without violating the storage resource use restrictions. If the operation is\n still unsuccessful, contact Cloud Customer Care for further assistance."]]
